Sublime Core Feed

This repo contains open-source Rules for Sublime, a free and open platform for detecting and preventing email attacks like BEC, malware, and credential phishing.

Sublime Security
Last updated Aug 24th, 2026
Feed Source
Tactic or Technique is
Rule Name & Severity
Author
Last Updated
Labels
Attachment: Fake lawyer & sports agent identities
Sublime Security
7mo ago
Jan 26th, 2026
Google share notification with suspicious comments
Sublime Security
7mo ago
Jan 12th, 2026
Impersonation: Employee name in subject with suspicious sender
Sublime Security
1mo ago
Jul 10th, 2026
Impersonation: Executive using numbered local part
Sublime Security
6mo ago
Jan 30th, 2026
Service Abuse: Box file sharing with credential phishing intent
Sublime Security
7mo ago
Jan 12th, 2026
Service abuse: Notion free-tier account impersonating VIP
Sublime Security
11d ago
Aug 14th, 2026
Service abuse: Trello board invitation with VIP impersonation
Sublime Security
6mo ago
Feb 3rd, 2026
Suspicious attachment with unscannable Cloudflare link
Sublime Security
7mo ago
Jan 12th, 2026
Suspicious request for financial information
Sublime Security
2mo ago
Jun 25th, 2026
VIP / Executive impersonation in subject (untrusted)
Sublime Security
1y ago
Aug 14th, 2025
VIP / Executive impersonation (strict match, untrusted)
Sublime Security
6mo ago
Feb 25th, 2026
VIP impersonation: Fabricated thread history with fake VIP recipients
Sublime Security
1mo ago
Jul 8th, 2026
VIP impersonation: Fake forwarded indicator with VIP recipient impersonation
Sublime Security
1mo ago
Jul 7th, 2026
VIP impersonation: Fake thread with display name match, email mismatch
Sublime Security
4mo ago
Apr 3rd, 2026
VIP impersonation: Fake thread with VIPs missing email metadata
Sublime Security
14d ago
Aug 11th, 2026
VIP impersonation: Invoice fraud with mobile device sign-off
Sublime Security
15d ago
Aug 10th, 2026
VIP impersonation: Payment handoff with VIP display name authored fake threads
Sublime Security
14h ago
Aug 24th, 2026
VIP Impersonation: VIP handoff with fake forwarded invoice thread
Sublime Security
8d ago
Aug 17th, 2026
VIP impersonation: VIP name within a delimited subject with fake previous threads
Sublime Security
1mo ago
Jul 8th, 2026
VIP impersonation: VIP payment redirect handoff via fake threads
Sublime Security
15d ago
Aug 10th, 2026
VIP impersonation: VIP recipient of previous thread with HTML generator
Sublime Security
1mo ago
Jul 7th, 2026
VIP impersonation with BEC language (near match, untrusted sender)
Sublime Security
5mo ago
Mar 25th, 2026
VIP impersonation with charitable donation fraud
Sublime Security
2mo ago
Jun 5th, 2026
VIP impersonation with invoicing request
Sublime Security
29d ago
Jul 27th, 2026
VIP impersonation with urgent request (strict match, untrusted sender)
Sublime Security
5mo ago
Mar 25th, 2026
VIP impersonation with w2 request with reply-to mismatch
Sublime Security
5mo ago
Mar 12th, 2026
VIP local_part impersonation from unsolicited sender
Sublime Security
27d ago
Jul 29th, 2026